Docker Hub Patched Critical Privilege Escalation Flaw Allowing Cross-User Image Access

A critical vulnerability in Docker Hub, the central registry for container image distribution, has been patched after existing for approximately two years. The flaw was located in the feature responsible for converting personal Docker accounts into organizational accounts. According to Docker's security advisory, the vulnerability could allow one user to push, pull, or delete images belonging to another user, potentially enabling container supply chain attacks, image tampering, or unauthorized distribution of malicious containers.

Docker confirmed that the flaw was fixed on September 30, 2026, and the associated security advisory was published on October 12, 2026. The company stated it found no evidence that the vulnerability was exploited in the wild, though the two-year window of potential exposure presents a significant historical risk for affected accounts.

The vulnerability stems from improper access controls during the account conversion process, which could have been abused to override user boundaries within the registry. Given Docker Hub's central role in the container ecosystem, the potential for supply chain compromise was considered significant. Users are advised to update their Docker Hub instances and review account security settings.